Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

Threat actors are actively exploiting recently disclosed PaperCut vulnerabilities (CVE-2026-81578 and CVE-2026-82078) to steal credentials from educational institutions in the U.S. and Europe. The attacks involve an authentication bypass and remote code execution chain, leading to command execution, reconnaissance, and the creation of privileged accounts. Post-exploitation activities include deploying tools for Windows registry hive collection and Meterpreter Java payloads.